all messages for Emacs-related lists mirrored at yhetil.org
 help / color / mirror / code / Atom feed
From: "Gerd Möllmann" <gerd.moellmann@gmail.com>
To: Po Lu <luangruo@yahoo.com>
Cc: Eli Zaretskii <eliz@gnu.org>,
	58042@debbugs.gnu.org, Alan Third <alan@idiocy.org>
Subject: bug#58042: 29.0.50; ASAN use-after-free in re_match_2_internal
Date: Wed, 05 Oct 2022 14:32:07 +0200	[thread overview]
Message-ID: <m27d1ev4c8.fsf@Mini.fritz.box> (raw)
In-Reply-To: <87lepuv5l8.fsf@yahoo.com> (Po Lu's message of "Wed, 05 Oct 2022 20:05:07 +0800")

Po Lu <luangruo@yahoo.com> writes:

> Gerd Möllmann <gerd.moellmann@gmail.com> writes:
>
>> Po Lu <luangruo@yahoo.com> writes:
>>
>>> I'm going to guess that window_sub_list is returning a window that was
>>> not marked during GC.  It's a problem that also exists with my
>>> incremental garbage collector.  Does this help?
>>>
>>> diff --git a/src/alloc.c b/src/alloc.c
>>> index 419c5e558b..522925d248 100644
>>> --- a/src/alloc.c
>>> +++ b/src/alloc.c
>>> @@ -6634,6 +6634,9 @@ mark_window (struct Lisp_Vector *ptr)
>>>        mark_glyph_matrix (w->desired_matrix);
>>>      }
>>>  
>>> +  if (w->next)
>>> +    mark_window (w->next);
>>> +
>>>    /* Filter out killed buffers from both buffer lists
>>>       in attempt to help GC to reclaim killed buffers faster.
>>>       We can do it elsewhere for live windows, but this is the
>>
>> Indeed, that seems to work!
>
> Could you please replace that code with:
>
>   if (!NILP (w->next)
>       && !vectorlike_marked_p (&XWINDOW (w->next)->header))
>     emacs_abort ();
>
> And see if Emacs ever aborts?
>
> I just remembered that the old garbage collector does not work the same
> way as the one in my branch, so that bug shouldn't be possible.

With the change

diff --git a/src/alloc.c b/src/alloc.c
index 419c5e558b..4e0dd12729 100644
--- a/src/alloc.c
+++ b/src/alloc.c
@@ -6625,6 +6625,15 @@ mark_window (struct Lisp_Vector *ptr)
 
   mark_vectorlike (&ptr->header);
 
+#if 1
+  if (!NILP (w->next)
+      && !vectorlike_marked_p (&XWINDOW (w->next)->header))
+    emacs_abort ();
+#else
+  if (!NILP (w->next))
+    mark_object (w->next);
+#endif
+
   /* Mark glyph matrices, if any.  Marking window
      matrices is sufficient because frame matrices
      use the same glyph memory.  */

I don't get an abort, but the ASAN error again

==67682==ERROR: AddressSanitizer: heap-use-after-free on address 0x000107130d00 at pc 0x0001002a481c bp 0x00016fdcc3c0 sp 0x00016fdcc3b8
READ of size 8 at 0x000107130d00 thread T0
    #0 0x1002a4818 in PSEUDOVECTORP lisp.h:1110
    #1 0x1002a4888 in SYMBOL_WITH_POS_P lisp.h:1122
    #2 0x10025a338 in EQ lisp.h:1342
    #3 0x100280eb0 in run_window_change_functions window.c:3964
    #4 0x1000f18c4 in redisplay_internal xdisp.c:16600
    #5 0x100107bf8 in redisplay xdisp.c:16111
    #6 0x10089364c in -[EmacsView layoutSublayersOfLayer:] nsterm.m:8661
    #7 0x1900a9624 in CA::Layer::layout_if_needed(CA::Transaction*)+0x224 (QuartzCore:arm64e+0x20624)
    #8 0x1901f661c in CA::Context::commit_transaction(CA::Transaction*,
    double, double*)+0x1c0 (QuartzCore:arm6

frame #8: 0x0000000100280eb4 emacs`run_window_change_functions at window.c:3964:7
   3961		     (de-)selected as its frame's or the globally selected
   3962		     window.  */
   3963		  if (((frame_selected_change
-> 3964			&& (EQ (window, old_selected_window)
   3965			    || EQ (window, selected_window)))
   3966		       || (frame_selected_window_change
   3967			   && (EQ (window, FRAME_OLD_SELECTED_WINDOW (f))

(lldb) p window
(Lisp_Object) $18 = 0x00000001071c2935 (struct window *) $23 = 0x00000001071c2930
(lldb) p old_selected_window
(Lisp_Object) $24 = 0x0000000107130d05 (struct Lisp_Vector *) $28 = 0x0000000107130d00

old_selected_window looks strange.  It's a global that is not
staticpro'd

\o/





  reply	other threads:[~2022-10-05 12:32 UTC|newest]

Thread overview: 65+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-09-24 13:45 bug#58042: 29.0.50; ASAN use-after-free in re_match_2_internal Gerd Möllmann
2022-09-24 14:17 ` Gerd Möllmann
2022-09-24 14:48   ` Gerd Möllmann
2022-09-24 14:56   ` Eli Zaretskii
2022-09-24 15:08     ` Gerd Möllmann
2022-09-24 15:24       ` Eli Zaretskii
2022-09-25  5:50         ` Gerd Möllmann
2022-09-25  6:32           ` Eli Zaretskii
2022-09-25  7:06             ` Gerd Möllmann
2022-09-25  8:08               ` Eli Zaretskii
2022-09-25  8:28                 ` Gerd Möllmann
2022-09-25  8:43                   ` Eli Zaretskii
2022-09-26  5:13                     ` Gerd Möllmann
2022-10-04 14:33 ` Gerd Möllmann
2022-10-04 16:35   ` Eli Zaretskii
2022-10-05  4:37     ` Gerd Möllmann
2022-10-05  6:16       ` Eli Zaretskii
2022-10-05  6:58         ` Gerd Möllmann
2022-10-05  7:22           ` Eli Zaretskii
2022-10-05  7:34             ` Gerd Möllmann
2022-10-05  9:00               ` Gerd Möllmann
2022-10-05  9:23                 ` Eli Zaretskii
2022-10-05 10:14                   ` Gerd Möllmann
2022-10-05 10:24                     ` Gerd Möllmann
2022-10-05 10:43                       ` Po Lu via Bug reports for GNU Emacs, the Swiss army knife of text editors
2022-10-05 10:49                         ` Gerd Möllmann
2022-10-05 11:10                           ` Gerd Möllmann
2022-10-05 11:15                             ` Po Lu via Bug reports for GNU Emacs, the Swiss army knife of text editors
2022-10-05 11:37                               ` Gerd Möllmann
2022-10-05 13:37                               ` Eli Zaretskii
2022-10-05 13:52                                 ` Po Lu via Bug reports for GNU Emacs, the Swiss army knife of text editors
2022-10-05 14:09                                   ` Eli Zaretskii
2022-10-05 14:24                                     ` Po Lu via Bug reports for GNU Emacs, the Swiss army knife of text editors
2022-10-05 13:27                             ` Eli Zaretskii
2022-10-05 13:31                               ` Gerd Möllmann
2022-10-05 13:55                                 ` Po Lu via Bug reports for GNU Emacs, the Swiss army knife of text editors
2023-05-08 14:01                         ` Stefan Monnier via Bug reports for GNU Emacs, the Swiss army knife of text editors
2023-05-09  1:04                           ` Po Lu via Bug reports for GNU Emacs, the Swiss army knife of text editors
2023-05-09  2:25                             ` Stefan Monnier via Bug reports for GNU Emacs, the Swiss army knife of text editors
2023-05-09  5:30                             ` Eli Zaretskii
2022-10-05 10:45                       ` Gerd Möllmann
2022-10-05 11:10                         ` Po Lu via Bug reports for GNU Emacs, the Swiss army knife of text editors
2022-10-05 11:15                           ` Gerd Möllmann
2022-10-05 11:23                             ` Po Lu via Bug reports for GNU Emacs, the Swiss army knife of text editors
2022-10-05 11:35                               ` Gerd Möllmann
2022-10-05 12:02                               ` Gerd Möllmann
2022-10-05 12:08                                 ` Po Lu via Bug reports for GNU Emacs, the Swiss army knife of text editors
2022-10-05 13:40                               ` Eli Zaretskii
2022-10-05 13:53                                 ` Po Lu via Bug reports for GNU Emacs, the Swiss army knife of text editors
2022-10-05 14:10                                   ` Eli Zaretskii
2022-10-05 12:05                             ` Po Lu via Bug reports for GNU Emacs, the Swiss army knife of text editors
2022-10-05 12:32                               ` Gerd Möllmann [this message]
2022-10-05 12:38                                 ` Gerd Möllmann
2022-10-05 12:49                                   ` Po Lu via Bug reports for GNU Emacs, the Swiss army knife of text editors
2022-10-05 12:48                                 ` Po Lu via Bug reports for GNU Emacs, the Swiss army knife of text editors
2022-10-06  5:20                                   ` Gerd Möllmann
2022-10-05 13:39                           ` Eli Zaretskii
2022-10-05 13:13                         ` Eli Zaretskii
2022-10-05 13:24                           ` Gerd Möllmann
2022-10-05 12:59                     ` Eli Zaretskii
2022-10-06  5:35 ` Gerd Möllmann
2022-10-06  6:59   ` Eli Zaretskii
2022-10-06  7:21     ` Gerd Möllmann
2022-10-06  8:08       ` Eli Zaretskii
2022-10-06  8:23         ` Gerd Möllmann

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=m27d1ev4c8.fsf@Mini.fritz.box \
    --to=gerd.moellmann@gmail.com \
    --cc=58042@debbugs.gnu.org \
    --cc=alan@idiocy.org \
    --cc=eliz@gnu.org \
    --cc=luangruo@yahoo.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
Code repositories for project(s) associated with this external index

	https://git.savannah.gnu.org/cgit/emacs.git
	https://git.savannah.gnu.org/cgit/emacs/org-mode.git

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.